Procedure examples

APT38 has used the Windows API to execute code within a victim's system.

SideCopy has executed malware by calling the API function `CreateProcessW`.

Kimsuky has utilized Native APIs to collect data from victim hosts and facilitate execution of malicious scripts.

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.

Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()`.

Mustang Panda has used various Windows API calls during execution and defense evasion.

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

Higaisa has called various native OS APIs.

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.

BlackTech has used built-in API functions.

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.

TA505 has deployed payloads that use Windows API calls on a compromised host.

Chimera has used direct Windows system calls by leveraging Dumpert.

Medusa Group has leveraged Windows Native API functions to execute payloads.

ToddyCat has used `WinExec` to execute commands received from C2 on compromised hosts.

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.

WIRTE has used the `RtlIpv4StringToAddressA` to convert IP-formatted string to a byte array.